PT-2024-37418

Name of the Vulnerable Software and Affected Versions: LXD versions 4.0 through 5.21.1 Description: A security issue was discovered in LXD's PKI mode, where a client's certificate could be used to bypass authentication if the certificate is present in the trust store, even if it is not signed by ...

Async Http Client Authorization Vulnerability

Async Http Client is AsyncHttpClient open source asynchronous Http and WebSocket client library for Java. An authorization issue vulnerability exists in Async Http Client version 3.0.0, which stems from an automatically enabled and self-managed CookieStore handling mechanism that can lead to...

WordPress plugin Photo Video Store: Cross-site Request Forgery vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed in the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site request forgery...

WordPress plugin Custom Post Type to Map Store: Cross-site Request Forgery Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site request forgery vulnerability...

WordPress Photo Video Store plugin <= 21.07 - CSRF to Cross Site Scripting (XSS) vulnerability

CSRF to Cross Site Scripting XSS vulnerability discovered by SOPROBRO Patchstack Alliance in WordPress Plugin Photo Video Store versions = 21.07...

WordPress Custom Post Type to Map Store plugin <= 1.1.0 - CSRF to Stored XSS vulnerability

CSRF to Stored XSS vulnerability discovered by SOPROBRO Patchstack Alliance in WordPress Plugin Custom Post Type to Map Store versions = 1.1.0...

Malware in redux-store-immutable

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malware in lightweight-store

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

org.hawkular.accounts:hawkular-accounts (>=2.0.7.final, <=2.0.10.final), org.hawkular.accounts:hawkular-accounts-api (>=2.0.7.final, <=2.0.10.final) +91 more potentially affected by CVE-2024-10039 via org.keycloak:keycloak-core (1.8.0.alpha1)

org.keycloak:keycloak-core MAVEN version 1.8.0.alpha1 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-core and may be impacted: - org.hawkular.accounts:hawkular-accounts =2.0.7.final, =2.0.7.final, =2.0.7.final, =2.0.7.final,...

org.hawkular.accounts:hawkular-accounts (>=2.0.23.final, <=2.0.39.final), org.hawkular.accounts:hawkular-accounts-api (>=2.0.23.final, <=2.0.39.final) +53 more potentially affected by CVE-2024-10039 via org.keycloak:keycloak-core (1.9.1.final)

org.keycloak:keycloak-core MAVEN version 1.9.1.final is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-core and may be impacted: - org.hawkular.accounts:hawkular-accounts =2.0.23.final, =2.0.23.final, =2.0.23.final, =2.0.23.final,...

Bootiful Spring Boot 3.4: Spring AI

I love Spring AI. It’s an amazing project designed to bring the patterns and practices of AI engineering to the Spring Boot developer. It’s got clean idiomatic abstractions that’ll make any Sring developer feel right at home, and it has a ton of integrations with all manner of different vector...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: f2fs: checked the validation of faultattrs in f2fsbuildfaultattr. It failed to check the validation of faultattrs in parseoptions; we will fix this by adding a check condition in f2fsbuildfaultattr. Also, use f2fsbuildfaultatt...

Astra Linux – Vulnerability in Python 3.11

A defect was discovered in the Python “ssl” module, where there is a memory race condition involving the methods “certstorestats” and “getcacerts” of the ssl.SSLContext class. This race condition can occur when these methods are called simultaneously with the loading of certificates into the...

CVE-2024-50200

In the Linux kernel, the following vulnerability has been resolved: mapletree: correct tree corruption on spanning store Patch series "mapletree: correct tree corruption on spanning store", v3. There has been a nasty yet subtle maple tree corruption bug that appears to have been in existence sinc...

CVE-2024-51920

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Pierre Jégo Map Store Locator map-store-location allows DOM-Based XSS.This issue affects Map Store Locator: from n/a through = 1.2.1...

CVE-2024-50519

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Josh Kohlbach Jigoshop – Store Exporter jigoshop-exporter allows Reflected XSS.This issue affects Jigoshop – Store Exporter: from n/a through = 1.5.8...

CVE-2024-50519 WordPress Jigoshop – Store Exporter plugin <= 1.5.8 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Josh Kohlbach Jigoshop – Store Exporter jigoshop-exporter allows Reflected XSS.This issue affects Jigoshop – Store Exporter: from n/a through = 1.5.8...

CVE-2024-50519 WordPress Jigoshop – Store Exporter plugin <= 1.5.8 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Josh Kohlbach Jigoshop – Store Exporter jigoshop-exporter allows Reflected XSS.This issue affects Jigoshop – Store Exporter: from n/a through = 1.5.8...

CVE-2024-50519

CVE-2024-50519 is a Reflected XSS vulnerability in Jigoshop – Store Exporter (WordPress plugin) affecting versions up to 1.5.8. Exploitation details (vector, payload) are not provided in the Initial doc, but Patchstack confirms the issue and assigns CVE-2024-50519 with a Medium/7.1 overall risk s...

CVE-2024-51920 WordPress Map Store Locator plugin <= 1.2.1 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Pierre Jégo Map Store Locator map-store-location allows DOM-Based XSS.This issue affects Map Store Locator: from n/a through = 1.2.1...